auth: Add a new cli_credentials_ccache_init()

Signed-off-by: Andreas Schneider <asn@samba.org>

s4-libsmb: Do not set empty password for gensec

GENSEC expects NULL as no password. There are too many places which
set "" instead of NULL. We plan to pass down the cli_credentials
structure anyway so this workaround should be ok for now.

Signed-off-by: Andreas Schneider <asn@samba.org>

auth: Do not set an empty realm

Just remove the @ sign and use it as a username.

Signed-off-by: Andreas Schneider <asn@samba.org>

auth: Do not set emtpy passwords for credentials

Signed-off-by: Andreas Schneider <asn@samba.org>

SKIP TESTS - DONT PUSH

sq gensec_gssapi_map_krb5_error

krb5 fallback

s4 make use of gensec_gssapi_try_kerberos()

TODO s4:auth/gensec: make use of gensec_gssapi... GENSEC_GSSAPI_HELPER

use gensec_gssapi_try_kerberos in source3/librpc/crypto/gse.c

auth/kerberos: add gensec_gssapi_try_kerberos()

Signed-off-by: Stefan Metzmacher <metze@samba.org>

TODO improve pdb_samba_dsdb_get_trusteddom_creds

s3:libads: let get_kdc_ip_string() also return kpasswd_server entries for each kdc

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12515

Signed-off-by: Stefan Metzmacher <metze@samba.org>

s3:libads: improve the logic in get_kdc_ip_string()

This fixes possible memory leaks on 'mem_ctx' and
always adds :88 (also for ipv4 addresses).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12515

Signed-off-by: Stefan Metzmacher <metze@samba.org>

REQUIRE NEW ldb version auth/credentials: use LDB_FLG_DONT_CREATE_DB and avoid creating secrets.ldb on domain members

Signed-off-by: Stefan Metzmacher <metze@samba.org>

s4:param: pass flags via secrets_db_connect() to ldb_wrap_connect()

Signed-off-by: Stefan Metzmacher <metze@samba.org>

sq Test python binding for package_PackagesBlob

selftest: only use the ntvfs server for ad_dc_ntvfs, rpc_proxy, promoted_dc and s4member*

Revert "s3:smbd: unimplement FSCTL_VALIDATE_NEGOTIATE_INFO with "server max protocol = SMB2_02""

This reverts commit def878b3aa74c81303fe4ba3fe69e20ee579dd55.

works

s3:smbd: unimplement FSCTL_VALIDATE_NEGOTIATE_INFO with "server max protocol = SMB2_02"

A client that supports SMB3 will do a signed FSCTL_VALIDATE_NEGOTIATE_INFO
after a tree connect. This FSCTL_VALIDATE_NEGOTIATE_INFO call contains
the client capabilities, client guid, security mode and the array of supported
dialects. But if SMB 2.02 is negotiated the doesn't send these values to the
server in the first connection attempt (when the client starts with a SMB1 Negotiate).

Windows servers that only support SMB2 just return NT_STATUS_FILE_CLOSED
as answer to FSCTL_VALIDATE_NEGOTIATE_INFO.

We should do the same if we just pretend to support SMB 2.02,
as SMB 2.10 always include an SMB2 Negotiate request we can leave it as is.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12772

Signed-off-by: Stefan Metzmacher <metze@samba.org>

run samba3.blackbox.smbclient_auth.plain with -mSMB...

selftest: run nt4_member with server max protocol = SMB3_02

This makes sure we don't regress with it.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Revert "s3:smbd: unimplement FSCTL_VALIDATE_NEGOTIATE_INFO with "server max protocol = SMB2_02""

This reverts commit efa5e47869ee88e5984e6763a40efa1eb2e64c9e.

Test python binding for package_PackagesBlob

Signed-off-by: Arvid Requate <requate@univention.de>

REVIEW: pidl/Python: make use of pyrpc_string_array_{from,to}_PyList()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
TODO: Reviewed-by: Arvid Requate <requate@univention.de>

pidl/Python: make use of pyrpc_PyStr_AsString() in ConvertStringFromPythonData()

This reduces the amount of generated code a lot.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

pidl/Python: generate a ndr_PyLong_AsCheckedLongLong() helper function

This reduces the size of the generated C code a lot.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

pidl/Python: generate a ndr_PyLong_AsCheckedUnsignedLongLong() helper function

This reduces the size of the generated C code a lot.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

pidl/Python: improve generation of error checking in FromPythonToUnionFunction()

Signed-off-by: Stefan Metzmacher <metze@samba.org>

pidl/Python: fix talloc hierachy in FromPythonToUnionFunction()

Signed-off-by: Stefan Metzmacher <metze@samba.org>

pidl/Python: avoid generation of dead code in FromUnionToPythonFunction()

Signed-off-by: Stefan Metzmacher <metze@samba.org>

pidl/Python: improve error handling in PythonFunctionUnpackOut() results

Signed-off-by: Stefan Metzmacher <metze@samba.org>

pidl/Python: improve error paths for Exceptions during the PyList construction

Signed-off-by: Stefan Metzmacher <metze@samba.org>

pidl/Python: stop processing if fail to create a PyObject from a C type

If the conversion from a C variable into a PyObject fails
(typically is raises an Exception), we need to stop processing
and propagate the error.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Revert "Test python binding for package_PackagesBlob"

This reverts commit cfc69410bbf4598fd18e1e1bce262e8a247df926.

Test python binding for package_PackagesBlob

Signed-off-by: Arvid Requate <requate@univention.de>

SIGN-OFF s4:pyrpc: add pyrpc_string_array_{from,to}_PyList()

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

TODO: Signed-off-by: Arvid Requate <requate@univention.de>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

s4:pyrpc: add pyrpc_PyStr_AsString() helper function

This contains the logic that's currently used in the pidl generated
python bindings. Moving this to a helper function will remove a lot
of generated code.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

talloc: improve pytalloc error code paths if talloc* fails

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Revert "TODO pyrpc_string_array_{from,to}_PyList()"

This reverts commit 27ec6e04894422e9988674985f8055bb9c7a6764.

TODO pyrpc_string_array_{from,to}_PyList()

cli_state_update_after_negprot source3/libsmb/cliconnect.c server_os...

overwrite... in cli_state_update_after_sesssetup

Revert "TODO NOT NEEDED cli_connect_sock_send/recv return sock_storage"

This reverts commit 6c0bd63a73bf8140fb92ea6896008109a0598097.

TODO NOT NEEDED cli_connect_sock_send/recv return sock_storage

Revert "s3:selftest: also run test_smbclient_s3.sh with PROTO=SMB3"

This reverts commit b689e911a42481aa5a66827bbf0b80b93d60c5f8.

s3:libsmb: change the connect banner to "Server=[%s] Protocol=[%s]"

s3:libsmb: pass an optional const struct sockaddr_storage *dest_ss to cli_cm_open()

Signed-off-by: Stefan Metzmacher <metze@samba.org>

s3:libsmb: pass 'dest_ss' from cli_cm_connect() via do_connect() to cli_connect_nb()

Signed-off-by: Stefan Metzmacher <metze@samba.org>

TODO use cli_state_dup

TODO: s3:libsmb: add cli_state_dup()

This can be used to create a 2nd cli_state for
a different tcon on the same connection/session.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Revert "run_oplock_cancel"

This reverts commit fbd15d778d26c3061140537b64a4e6dc5baf5dad.

run_oplock_cancel

Revert "WORKS BUT NOT NEEDED s3:smbd: allow cancelling deferred SMB1 opens"

This reverts commit bf5b33b83f7d0ca13d07d8c53651b8664df137ac.

WORKS BUT NOT NEEDED s3:smbd: allow cancelling deferred SMB1 opens

The Windows 2012R2 behaviour seems to be a NTCREATE response
with STATUS_CANCELLED, but the underlying open is not really
cancelled and a following open get SHARING_VIOLATION.

Revert "s3:libsmb: remove unused show_sessetup handling from do_connect()"

This reverts commit b6f66cf85fafa08aed5692d76940908854310e93.

Revert "more enctypes..."

This reverts commit f5cfd4aa8b4dfb442f1abfc61ef66cdb0b8cd09a.

more enctypes...

Revert "HACK... https://bugzilla.samba.org/show_bug.cgi?id=12892"

This reverts commit 4da2a7a9f9261ab18207699a102069040b652c24.

HACK... https://bugzilla.samba.org/show_bug.cgi?id=12892

s3:libsmb: add support for SMB2/3 in cli_chkpath()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12968

Signed-off-by: Stefan Metzmacher <metze@samba.org>

debug REVISION_MISMATCH

more [flag(NDR_SECRET)]...

.gitlab-ci.yml: merge .gitlab-ci-private.yml

`.gitlab-ci.yml` support conditional jobs with `only` and `except`.
And variables can be read from repo CI/CD settings as condition:

    build_samba:
      script: ...
      only:
        variables:
          - $SUPPORT_PRIVATE_TEST == 'yes'

Instead of having 2 copies of yml file, we can use this feature to
trigger private jobs only when a var like `SUPPORT_PRIVATE_TEST` is defined.

I've already added above var to our repos.
Once merged, we can remove custom CI config file in
gitlab repo settings, and remove .gitlab-ci-private.yml file from code.

Signed-off-by: Joe Guo <joeg@catalyst.net.nz>
Reviewed-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Feb 18 10:54:19 CET 2019 on sn-devel-144

wafsamba/symbols: change regex to match both rpath and runpath for different readelf output

In `wafsamba.dumplicate_symbols` test, it will use Popen to call:

    readelf --dynamic bin/default/source3/lib/netapi/examples/netlogon/netlogon_control2

then try to find rpath lib lines from output with regex:

    re_rpath     = re.compile(b'Library rpath: \[(.*)\]')

In ubuntu 14.04 docker image, which current CI is using, the actual output
from `readelf` is `runpath` instead of 'rpath':

    ...
    Library runpath: [/home/gitlab-runner/samba/bin/shared:/home/gitlab-runner/samba/bin/shared/private]\n'
    ...

So the regex never matched, and hide a bug.

In Ubuntu 1604 docker image, the output changes to `rpath` and matched the
regex, which expose the error in previous commit.

Improve the regex to match both `rpath` and `runpath`.

Signed-off-by: Joe Guo <joeg@catalyst.net.nz>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

wafsamba/symbols: always split Popen output by bytes

In py3, `wafsamba.duplicate_symbols` test may fail:

    ...
    elfpipe = subprocess.Popen(['readelf', '--dynamic', binname], stdout=subprocess.PIPE).stdout
    ...

    File "./buildtools/wafsamba/symbols.py", line 153, in get_libs
        rpath.extend(m.group(1).split(":"))
    TypeError: a bytes-like object is required, not 'str'

Because Popen will always return bytestr even in py3, and ":" is a
unicode str in py3.  Change ":" to b":" to fix.

Signed-off-by: Joe Guo <joeg@catalyst.net.nz>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

selftest: Initialize DC_SERVER/etc variables in one place

It's simpler to do setup DC_SERVER/etc in the same place we set
SERVER/etc. (Rather than initializing them for every single testenv,
like we were doing).

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Feb 18 07:24:05 CET 2019 on sn-devel-144

selftest: Add helper function to avoid repeated {DC_SERVER}=x

For every 2-DC testenv we setup, we copy the $DC_SERVER value of the
dependent testenv (i.e. the PDC) into the env variables for the new
testenv. This means DC_SERVER always points to the PDC (or first DC).

This adds a helper function to avoid repeating this code for every 2-DC
environment we setup.

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

selftest: Remove need for $RODC_DC_SERVER env variable

Same deal as earlier patch - we can use the $SERVER env variable instead
and avoid the need for this extra variable.

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

selftest: Remove unused environment variables

We only really want generic environment variables. For 2+ DC
environments, we have the $SERVER and $DC_SERVER (aka PDC) variables.
However, lots of testenvs also export really specific environment
variables, e.g. VAMPIRE_2000_DC_SERVER_IP (despite that testenv being
only used for a single test case).

Previously the <testenv>_SERVER variable was used for DRS tests, but we
can avoid the need to do this now. The other variables are not used at
all.

The RODC and TRUST environment variables are still used by a few tests.
SUBDOM_DC_SERVER is only used within Samba4.pm and not exported.

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

tests: Tweak DRS tests to avoid unnecessary env variables

Each DC used in a DRS test has its own '<testenv>_SERVER' environment
variable, e.g. VAMPIRE_DC_SERVER. These variables are only used by
test.py for DRS, but they're not actually needed.

The $SERVER environment variable holds the same information, so we can
just use this in test.py instead.

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

selftest: Export DC conf path for special cases

In a few rare cases, a test needs to assert aspects both client-side and
server-side aspects. A typical example would be the audit logging, which
is exercising client-side behaviour, but also asserting the server-side
logging.

Usually this has involved a kludge in tests.py to either use
socket-wrapper explicitly, or hardcode in the server smb.conf path.

This patch exposes the existing SERVERCONFFILE env variable to the
tests. DC_SERVERCONFFILE has been added for 2 DC testenvs, where we need
the PDC's smb.conf.

The benefit of doing this way is the filepath/testenv-dependency logic
is all self-contained with the Perl code, and it doesn't bleed out into
tests.py as well.

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

selftest: Add common function to return cmd environment variables

We prefix samba-tool commands with a bunch of WRAPPER/CONF environment
variables, in order for the command to work properly. These variables
are duplicated all over the place in the selftest code. This patch adds
a helper function to return the variables, so we can reduce the required
code down to a single line in a lot of places.

A couple of exceptions I've left alone:
- drs replicate, which omits the RESOLV_WRAPPER_CONF/_HOSTS variables
  (I'm not sure whether that's deliberate or not).
- create_backup(), which uses the backupfromdc's krb5.conf rather than
  the new testenv.

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

third_party/nss_wrapper/wscript: check for libnsl and libsocket

this is needed as there are HAVE_LIBNSL and HAVE_LIBSOCKET in the code and
Samba fails to build in a terrible obscure way on Solaris if this is not
working inside nss_wrapper here.

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Björn Jacke <bjacke@samba.org>
Autobuild-Date(master): Sun Feb 17 15:05:20 CET 2019 on sn-devel-144

waf: add library dependency for sendfile on Solaris

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

third_party/nss_wrapper/wscript: fix check for gethostbyname

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

waf: fix setting of RPATH_ST variable

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

wafsamba: we should also remove stale symlinks here

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

waf: print the library name in which we search for a function

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

waf: use the correct WERROR_CFLAGS in CHECK_CODE

all the non gcc version were incorrectly set here till now

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

waf: remove redundant WERROR flag

CHECK_CFLAGS always uses WERROR flags

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

waf: remove duplicate WERROR cflags

WERROR flags are already added by the strict=True switch.

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

waf: fix compiler warnings in configure checks

the studio compiler issued here:

warning: statement not reached

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

waf: fix WERROR_CFLAGS check

if we found the right WERROR flags of the compiler then the compiler is right
to fail because we explicitly give it an empty file to compile. We
should not do that because that makes the almost successful test fail.
This fixed the studio compiler test.

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

waf: fix some missing newline compiler warnings

without a trailing newline the studio compiler issues:

warning: newline not last character in file

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

sysquotas_4B: raise log level of a sometimes too noisy message

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

waf/quotas: fail configure when quotas were requested but not found

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

quotas: remove legacy AIX quota code that is covered by sysquotas now

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

tests/sysquotas.c: include jfs/quota.h for 4B test on AIX

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

add sysquotas_jfs2.c

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

sysquotas_4B: enable for jfs/quota.h on AIX

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

sysquotas_4B: make quota block calculation adopt to platform quota block size

the correct QUOTABLOCK_SIZE for platform is taken from sysquotas.h

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

waf: check for jfs/quota.h

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

sysquotas.h: collect more platform quotablock sizes

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

tests/quota: tidy up includes of sysquotas 4B

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

sysquotas_nfs: also honor reported inode/file limits

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

sysquotas_xfs: fix inode limit setting, which is not depeding on blocksize

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

sysquotas_linux: fix inode limit setting, which is not depeding on blocksize

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

ntquotas: do not set inode limits when setting space quota

we are supposed to set a space quota limit, we should not calculate an
additional artifical inode limit out of that.

Signed-off-by: Bjoern Jacke <bjacke@samba.org>